keystone-engine/keypatch

Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.

keypatch's Issues

keypatch.py does not support Keystone-v0.9.2

Traceback (most recent call last):
File "D:/crack/PC/IDA 7.0/plugins/keypatch.py", line 1554, in activate
self.plugin.patcher()
File "D:/crack/PC/IDA 7.0/plugins/keypatch.py", line 1814, in patcher
selection, addr_begin, addr_end = read_range_selection()
File "D:\crack\PC\IDA 7.0\python\ida_kernwin.py", line 2062, in read_range_selection
return _ida_kernwin.read_range_selection(*args)
TypeError: read_range_selection expected 1 arguments, got 0

About endian switch bug on arm ins assembly

Details
Recently，as a software reverse newbee. I’m try to crack a Ali crackme.apk(attachment).
Find the check func is in Android Native Code .So I use IDA Pro to dynamic debugging, find anti-debug method. I need to Turn around this ，I need to alter the memory and didn't find the function in IDA like OllyDBG to alter binary code by alter ASM sentences. So I’d
like to appreciate to god that I find. the great works you have built ,And I find some problems(big endian and little endian’ switch) as I twitter U.

A little Suggestion
If this is my project , I would like to switch endian Mode can be choose by user. If occur a error，it can be corrected manually.

THX
TwitterFromDelphicGeek.zip

Keypatch cannot launch in IDA 7.0

I use Windows 10 platform.
Open the IDA, and load keystone plugin, but it did not work.
here is my problem:
E:\IDA 7.0\plugins\keypatch.py: invalid syntax (E:/IDA 7.0/plugins/keypatch.py, line 7)
Traceback (most recent call last):
File "E:\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
execfile(script, g)
File "E:/IDA 7.0/plugins/keypatch.py", line 7

^
SyntaxError: invalid syntax

I installed the .msi in your website, and copied the keypatch.py to the plugins folder.

How can I fix it?Thank you.

keypatch.py:DLL load failed:%1 is not a valid Win32 application

Sorry,I copyed the wrong python27.dll(32bit) to ida directory.

ARM processor detection problem

Hello,
I'm working with Cortex-M3 firmware images. This MCU only supports Thumb2 instructions, which might be the reason why these files are neither 32 or 64 bit in the info structure. That's how I solved this problem for me:

diff --git a/keypatch.py b/keypatch.py
index a8ea4da..a9a13f4 100644
--- a/keypatch.py
+++ b/keypatch.py
@@ -106,6 +106,9 @@ class Keypatch_Asm:
                     mode = KS_MODE_ARM | KS_MODE_LITTLE_ENDIAN
                 else:
                     mode = KS_MODE_ARM | KS_MODE_BIG_ENDIAN
+            else:
+                arch = KS_ARCH_ARM
+                mode = KS_MODE_THUMB | KS_MODE_LITTLE_ENDIAN
         elif cpuname.startswith("sparc"):
             arch = KS_ARCH_SPARC
             if info.is_64bit():

Installation Issue: "ImportError: cannot import name arm_const"

"ImportError: cannot import name arm_const"

Hi,

I want to install keystone on my Mac 10.12.6, IDA Pro 7.0;

After following the instructions https://github.com/keystone-engine/keypatch/issues/28, I installed all required python and dylib. And keystone can be import from my own /usr/bin/python.

However, I got an ImportError: cannot import name arm_const when import keystone in the console of ida and don't know why.

I wasted several hours on searching the solution but nothing worked.

Any suggestions?

Thanks!

failed while executing plugin

Attempted relative import in non-package

C:\Users\Tuan Linh\Desktop\IDA7.0\IDAPro7.0.Green.patch\plugins\keypatch.py: Attempted relative import in non-package
Traceback (most recent call last):
File "C:\Users\Tuan Linh\Desktop\IDA7.0\IDAPro7.0.Green.patch\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
execfile(script, g)
I was trying install Keypatch on IDA 7.0 on Windows and got this error.

File "C:/Users/Tuan Linh/Desktop/IDA7.0/IDAPro7.0.Green.patch/plugins/keypatch.py", line 23, in
from keystone import *
File "C:\Users\Tuan Linh\Desktop\IDA7.0\IDAPro7.0.Green.patch\python\keystone.py", line 9, in
from . import arm_const, arm64_const, mips_const, sparc_const, hexagon_const, ppc_const, systemz_const, x86_const
ValueError: Attempted relative import in non-package

Cannot install KeyPatch in IDA7.0 on Win10

I use IDA7.0 on Win10.When I follow your step to install the latest keypatch,IDA 7.0 cannot import this plugins.

the step I follow

1. download the keypatch from github [https://github.com/keystone-engine/keypatch] and place keypatch.py into IDA 7.0/plugins/

2. download the 64-bit keystone msi [http://www.keystone-engine.org/download/] and install the keystone module,because i use 64-bit python2.7.13 in my os.

but it doesn't work,and got these error:(from IDA output window)

  bytes   pages size description
--------- ----- ---- --------------------------------------------
   262144    32 8192 allocating memory for b-tree...
    65536     8 8192 allocating memory for virtual array...
   262144    32 8192 allocating memory for name pointers...
-----------------------------------------------------------------
   589824            total memory allocated

Loading processor module D:\Program Files\IDA 7.0\procs\pc64.dll for metapc...OK
Loading type libraries...
Autoanalysis subsystem has been initialized.
D:\Program Files\IDA 7.0\plugins\keypatch.py: ERROR: fail to load the dynamic library.
Traceback (most recent call last):
  File "D:\Program Files\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
    execfile(script, g)
  File "D:/Program Files/IDA 7.0/plugins/keypatch.py", line 53, in <module>
    from keystone import *
  File "D:\python\python2\lib\site-packages\keystone\__init__.py", line 4, in <module>
    from .keystone import Ks, ks_version, ks_arch_supported, version_bind, debug, KsError, __version__
  File "D:\python\python2\lib\site-packages\keystone\keystone.py", line 75, in <module>
    raise ImportError("ERROR: fail to load the dynamic library.")
ImportError: ERROR: fail to load the dynamic library.

Database for file 'vul' has been loaded.
Hex-Rays Decompiler plugin has been loaded (v7.0.0.170914)
  License: 55-BAE5-8A04-93 Jiang Ying, Personal license (1 user)
  The hotkeys are F5: decompile, Ctrl-F5: decompile all.
  Please check the Edit/Plugins menu for more informaton.
IDAPython Hex-Rays bindings initialized.
D:\Program Files\IDA 7.0\plugins\keypatch.py: cannot import name arm_const
Traceback (most recent call last):
  File "D:\Program Files\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
    execfile(script, g)
  File "D:/Program Files/IDA 7.0/plugins/keypatch.py", line 53, in <module>
    from keystone import *
  File "D:\python\python2\lib\site-packages\keystone\__init__.py", line 2, in <module>
    from . import arm_const, arm64_const, mips_const, sparc_const, hexagon_const, systemz_const, ppc_const, x86_const
ImportError: cannot import name arm_const

---------------------------------------------------------------------------------------------
Python 2.7.13 (v2.7.13:a06454b1afa1, Dec 17 2016, 20:53:40) [MSC v.1500 64 bit (AMD64)] 
IDAPython 64-bit v1.7.0 final (serial 0) (c) The IDAPython Team <[email protected]>
---------------------------------------------------------------------------------------------

I dive into deep step

When I google to solve this problem,I find your install tips from http://www.keystone-engine.org/keypatch/

A1. Windows

It is easiest to just download & install Python 2.7 module for Windows from http://www.keystone-engine.org/download. Be sure to get the 32-bit version, regardless of your Windows edition. 【32-bit python?】

If you prefer to compile from source, just use MSVC 32-bit & follow the instructions in Windows documentation to build keystone.dll. After that, install Python module as in Python documentation. Then copy keystone.dll to the directory of Keystone Python module.

In case you did all the above steps, but IDA still complains “fail to load the dynamic library”, then copy the whole directory keystone at C:\Python27\Lib\site-packages\keystone to C:\Program Files (x86)\IDA 6.8\python, so you have directory C:\Program Files (x86)\IDA 6.8\python\keystone after that (Use your actual IDA directory instead).

so I change my python-64-bit to python-32-bit,and reinstall the keystone-32bit-msi,at the same time,I copy the modles D:\python\python2\Lib\site-packages\keystone to D:\Program Files\IDA 7.0\python,and still get the same error in IDA7.0 output windows,

So what's the problem?

 File "D:/Program Files/IDA 7.0/plugins/keypatch.py", line 53, in <module>
    from keystone import *
  File "D:\python\python2\lib\site-packages\keystone\__init__.py", line 2, in <module>
    from . import arm_const, arm64_const, mips_const, sparc_const, hexagon_const, systemz_const, ppc_const, x86_const
ImportError: cannot import name arm_const

notice this "D:\python\python2\lib\site-packages\keystone_init_.py" is not the correct format in window,and the modle import failed,it the keypatch.py and kestone modle for python something wrong?

No module named 'keystone' on OSX

Hello,

Installed keystone engine using pip and everything is working fine from python (no venv here). However, IDA (6.95.160808 (64-bit or 32-bit)) cannot find the module.

Probably a symlink problem...

Thanks!

arm patch error

Keypatch: attempt to modify "SUB SP, SP, #8" at 0xB618 to "SUB SP, SP, #0xc"
Keypatch: successfully patched 4 byte(s) at 0xB618 from [82 B0 19 A9] to [0C D0 4D E2]
this should be from [82 B0 19 A9] to [83 B0 19 A9].

error after installing

immediately after install on v6.95.160808 I get the following err on startup.

keypatch.py: name 'KS_ARCH_X86' is not defined
Traceback (most recent call last):
  File "C:\Program Files (x86)\IDA 6.95\python\ida_idaapi.py", line 509, in IDAPython_ExecScript execfile(script, g)
  File "C:/Program Files (x86)/IDA 6.95/plugins/keypatch.py", line 111, in <module> class Keypatch_Asm:
  File "C:/Program Files (x86)/IDA 6.95/plugins/keypatch.py", line 114, in Keypatch_Asm
"X86 16-bit": (KS_ARCH_X86, KS_MODE_16),                # X86 16-bit NameError: name 'KS_ARCH_X86' is not defined

When the base address is relatively large, the transfer instruction will fail to assemble

When the base address is relatively large, the transfer instruction will fail to assemble

Wrong fixup & encode tabs

When i try to patch and hit CTRL+Alt+K i get the patch window but the default fixup & encode tab show a different value than the Original tab.
This means that if i want to change a command i need to retype it all.
e.g. change jnz loc_12345678 ==> jmp loc_1234567

is this intentional or a bug?

i am using IDA 7 on win10 with keypatch (2.2) 2.1 is not working with IDA 7

TODO for Keypatch

we maintain a TODO list for Keypatch at https://github.com/keystone-engine/keypatch/wiki.

if you want to contribute, feel free to pick up something from the list. look forward to pull requests, thanks!

if you want to request new features for the next version of Keypatch, put your thoughts here in this issue.

Patcher menu broken on IDA 7.2

Since IDA 7.2 beta (and including the final release), the Patcher menu no longer works. Instead, the following is presented to the user:

port it to ida 7.4 and python3

Hi,

Is it possible to port it to ida 7.4 please ?

Installation guid on windows

Please add instllation guid to keypatch(and ketstone) if I use ida pro on windows

Thank

Update appendix for IDA 7.0

IDA 7.0 is now a native x64 application, which means it is now using Python 2.7 x64. So it would be great if we can update the appendix.

How to patch string?

It is supported?

Linux 64bit, incorrect name of the keystone lib in keystone folder

Hi,
After digging around I found the bug for the "Fail to load the dynamic library.
Stracing IDA shows that it search for a libkeystone.so and not a libkeystone.so.0.
Also in your documentation under linux it's not working if you copy the keystone folder in ida-xx/python.
We must copy it to /opt/ida-xxx/python/lib/python2.7.
Then renaming the lib did the tricks.

Loading processor module /opt/ida-6.95/procs/arm.ilx for ARM...OK
keypatch.py: ERROR: fail to load the dynamic library.
Traceback (most recent call last):
File "/opt/ida-6.95/python/ida_idaapi.py", line 509, in IDAPython_ExecScript
execfile(script, g)
File "/opt/ida-6.95/plugins/keypatch.py", line 23, in
from keystone import *
File "/opt/ida-6.95/python/lib/python2.7/keystone/init.py", line 4, in
from .keystone import Ks, ks_version, ks_arch_supported, version_bind, debug, KsError, version
File "/opt/ida-6.95/python/lib/python2.7/keystone/keystone.py", line 74, in
raise ImportError("ERROR: fail to load the dynamic library.")
ImportError: ERROR: fail to load the dynamic library.

Problem Did it all fine, willing to answer any questions

Failed while executing plugin_t.init():
Traceback (most recent call last):
File "C:/Program Files/IDA 7.0/plugins/keypatch.py", line 1499, in init
menu = idaapi.add_menu_item("Edit/Keypatch/", "Patcher (Ctrl-Alt-K)", "", 1, self.patcher, None)
AttributeError: 'module' object has no attribute 'add_menu_item'

error on macos mojave

sudo python setup.py install
Password:
running install
running build
running build_py
creating build
creating build/lib
creating build/lib/keystone
copying keystone/mips_const.py -> build/lib/keystone
copying keystone/sparc_const.py -> build/lib/keystone
copying keystone/keystone.py -> build/lib/keystone
copying keystone/__init__.py -> build/lib/keystone
copying keystone/keystone_const.py -> build/lib/keystone
copying keystone/systemz_const.py -> build/lib/keystone
copying keystone/arm64_const.py -> build/lib/keystone
copying keystone/x86_const.py -> build/lib/keystone
copying keystone/ppc_const.py -> build/lib/keystone
copying keystone/arm_const.py -> build/lib/keystone
copying keystone/hexagon_const.py -> build/lib/keystone
running build_clib
running custom_build_clib
building 'keystone' library
-- The C compiler identification is AppleClang 10.0.0.10001044
-- The CXX compiler identification is AppleClang 10.0.0.10001044
-- Check for working C compiler: /Library/Developer/CommandLineTools/usr/bin/cc
-- Check for working C compiler: /Library/Developer/CommandLineTools/usr/bin/cc -- broken
CMake Error at /usr/local/Cellar/cmake/3.12.4/share/cmake/Modules/CMakeTestCCompiler.cmake:52 (message):
  The C compiler

    "/Library/Developer/CommandLineTools/usr/bin/cc"

  is not able to compile a simple test program.

  It fails with the following output:

    Change Dir: /Users/carlstar/Downloads/keystone-engine-0.9.1-3/src/build/CMakeFiles/CMakeTmp

    Run Build Command:"/usr/bin/make" "cmTC_c527c/fast"
    /Library/Developer/CommandLineTools/usr/bin/make -f CMakeFiles/cmTC_c527c.dir/build.make CMakeFiles/cmTC_c527c.dir/build
    Building C object CMakeFiles/cmTC_c527c.dir/testCCompiler.c.o
    /Library/Developer/CommandLineTools/usr/bin/cc   -arch i386 -arch x86_64 -isysroot /Library/Developer/CommandLineTools/SDKs/MacOSX10.14.sdk   -o CMakeFiles/cmTC_c527c.dir/testCCompiler.c.o   -c /Users/carlstar/Downloads/keystone-engine-0.9.1-3/src/build/CMakeFiles/CMakeTmp/testCCompiler.c
    Linking C executable cmTC_c527c
    /usr/local/Cellar/cmake/3.12.4/bin/cmake -E cmake_link_script CMakeFiles/cmTC_c527c.dir/link.txt --verbose=1
    /Library/Developer/CommandLineTools/usr/bin/cc   -arch i386 -arch x86_64 -isysroot /Library/Developer/CommandLineTools/SDKs/MacOSX10.14.sdk -Wl,-search_paths_first -Wl,-headerpad_max_install_names   CMakeFiles/cmTC_c527c.dir/testCCompiler.c.o  -o cmTC_c527c
    ld: warning: The i386 architecture is deprecated for macOS (remove from the Xcode build setting: ARCHS)
    ld: warning: ignoring file /Library/Developer/CommandLineTools/SDKs/MacOSX10.14.sdk/usr/lib/libSystem.tbd, missing required architecture i386 in file /Library/Developer/CommandLineTools/SDKs/MacOSX10.14.sdk/usr/lib/libSystem.tbd
    ld: dynamic main executables must link with libSystem.dylib for architecture i386
    clang: error: linker command failed with exit code 1 (use -v to see invocation)
    make[1]: *** [cmTC_c527c] Error 1
    make: *** [cmTC_c527c/fast] Error 2




  CMake will not be able to correctly generate this project.
Call Stack (most recent call first):
  CMakeLists.txt:5 (project)


-- Configuring incomplete, errors occurred!
See also "/Users/carlstar/Downloads/keystone-engine-0.9.1-3/src/build/CMakeFiles/CMakeOutput.log".
See also "/Users/carlstar/Downloads/keystone-engine-0.9.1-3/src/build/CMakeFiles/CMakeError.log".
running install_lib
creating /usr/local/lib/python2.7/site-packages/keystone
copying build/lib/keystone/mips_const.py -> /usr/local/lib/python2.7/site-packages/keystone
copying build/lib/keystone/sparc_const.py -> /usr/local/lib/python2.7/site-packages/keystone
copying build/lib/keystone/keystone.py -> /usr/local/lib/python2.7/site-packages/keystone
copying build/lib/keystone/__init__.py -> /usr/local/lib/python2.7/site-packages/keystone
copying build/lib/keystone/keystone_const.py -> /usr/local/lib/python2.7/site-packages/keystone
copying build/lib/keystone/systemz_const.py -> /usr/local/lib/python2.7/site-packages/keystone
copying build/lib/keystone/arm64_const.py -> /usr/local/lib/python2.7/site-packages/keystone
copying build/lib/keystone/x86_const.py -> /usr/local/lib/python2.7/site-packages/keystone
copying build/lib/keystone/ppc_const.py -> /usr/local/lib/python2.7/site-packages/keystone
copying build/lib/keystone/arm_const.py -> /usr/local/lib/python2.7/site-packages/keystone
copying build/lib/keystone/hexagon_const.py -> /usr/local/lib/python2.7/site-packages/keystone
byte-compiling /usr/local/lib/python2.7/site-packages/keystone/mips_const.py to mips_const.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/keystone/sparc_const.py to sparc_const.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/keystone/keystone.py to keystone.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/keystone/__init__.py to __init__.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/keystone/keystone_const.py to keystone_const.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/keystone/systemz_const.py to systemz_const.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/keystone/arm64_const.py to arm64_const.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/keystone/x86_const.py to x86_const.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/keystone/ppc_const.py to ppc_const.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/keystone/arm_const.py to arm_const.pyc
byte-compiling /usr/local/lib/python2.7/site-packages/keystone/hexagon_const.py to hexagon_const.pyc
running install_data
error: can't copy 'src/build/llvm/lib/libkeystone.dylib': doesn't exist or not a regular file

What's the proper way to export the patched idb by keypatch into a binary?

The situation I'm running into is follows:

1. I patch an instruction with keypatch, using IDA's Edit->Patch Program->Apply Patches to Input File
2. I undo that patch

In this case if I go to Apply Patches to Input File again, IDA would think there's no bytes to be patched (because the database is the same as the initial database) as it shows Applied 0/0 patch(es), but in the real world, the binary has already been patched since step 1, and this is not undone. Thus I'm curious what's the correct way to export the patched idb with undos from keypatch?

ERROR: fail to load the dynamic library using ida pro 7 - win10

I followed all the solution i could find for this.
in short, after running: keystone-0.9.1-python-win32.msi
I copied the entire
c:\Python27\Lib\site-packages\keystone\ to
c:\Program Files\IDA 7.0\python\keystone\

copied keypatch.py (v2.1)
to
c:\Program Files\IDA 7.0\plugins\

python27 in in my $PATH
I still get errors.
Any ideas what i can do?

I also verified i have VC++ (2017) x86 installed

C:\Program Files\IDA 7.0\plugins\keypatch.py: ERROR: fail to load the dynamic library.
Traceback (most recent call last):
File "C:\Program Files\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
execfile(script, g)
File "C:/Program Files/IDA 7.0/plugins/keypatch.py", line 23, in
from keystone import *
File "C:\Program Files\IDA 7.0\python\keystone_init.py", line 4, in
from .keystone import Ks, ks_version, ks_arch_supported, version_bind, debug, KsError, version
File "C:\Program Files\IDA 7.0\python\keystone\keystone.py", line 74, in
raise ImportError("ERROR: fail to load the dynamic library.")
ImportError: ERROR: fail to load the dynamic library.

Database for file 'DaPainter.exe' has been loaded.
Hex-Rays Decompiler plugin has been loaded (v7.0.0.170914)
License: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
The hotkeys are F5: decompile, Ctrl-F5: decompile all.
Please check the Edit/Plugins menu for more informaton.
IDAPython Hex-Rays bindings initialized.
C:\Program Files\IDA 7.0\plugins\keypatch.py: cannot import name arm_const
Traceback (most recent call last):
File "C:\Program Files\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
execfile(script, g)
File "C:/Program Files/IDA 7.0/plugins/keypatch.py", line 23, in
from keystone import *
File "C:\Program Files\IDA 7.0\python\keystone_init_.py", line 2, in
from . import arm_const, arm64_const, mips_const, sparc_const, hexagon_const, systemz_const, ppc_const, x86_const
ImportError: cannot import name arm_const_

Java support

Hello, please let me ask your....

Is there any plan to support JAVA patching?

Thanks in advance.

IDA 7 keypatch not working

Failed while executing plugin_t.init():
Traceback (most recent call last):
File "D:/IDA 7.0/plugins/keypatch.py", line 1499, in init
menu = idaapi.add_menu_item("Edit/Keypatch/", "Patcher (Ctrl-Alt-K)", "", 1, self.patcher, None)
AttributeError: 'module' object has no attribute 'add_menu_item'

how can i get the so file with changed

it seems that the changes are in the idb file,thanks

keypatch.py: ERROR: fail to load the dynamic library.

Hi y'all, trying to install keypatch on Ubuntu 16.04.1 LTS:

Followed the instructions but can't get IDA to load the keypatch plugin successfully.

First error I get when starting IDA 6.95 is:

keypatch.py: ERROR: fail to load the dynamic library.
and
keypatch.py: cannot import name arm_const

even though:

xxx@xxx:/opt/ida-6.95/python/lib/python2.7/dist-packages/keystone
-rwxr-xr-x 1 root root 6497308 Aug 31 22:38 libkeystone.so.0

help appreciated!

FAILED to process this input

I use IDA 7.0.170914 on Windows 10 x64 with Keypatch v2.2.
When i try to patch instructions, I always get the "FAILED to process this input" error.

Keypatch: attempting to fill range [0x100DE6:0x100DE5] with "mov eax, 42"
Keypatch: successfully filled range [0x100DE6:0x100DE5] (0 bytes) with "mov eax, 42", replaced ""
Keypatch: FAILED to process this input 'mov eax, 42'
Keypatch: successfully reverted 0 byte(s) at 0x100DE6 from [] to []

Failed to assembly when converted to code in IDA

I use IDAP Pro 7.1 wich keypatcher 2.2. At address 0048ED60 I want to insert some code:

I inserted push esp:

After hitting the patch button I get this:

That is correct. IDA tries to interpret the code. When I now try to continue editing lie in this screenshot:

and hit the Patch button, then I get the following error.

In order to make the plugin work I need to cancel editing after the first operation. Go to the edited address 0048ED60 and hit u für undefine. After that I can continue with the keypatcher.

Can you please fix that? It makes multi editing very hard.

LDR instruction on the issue of the ARM architecture

Hello!
I have a problem using keypatch under IDA.
It is about the LDR instruction.The instruction binary generated by Keypatch is different from the original instruction binary.
See the figure below for details:

IDA64 down when trying to assemble x64

try yourself to assemble an instruction that match pattern movzx r*, *h
like

movzx r8, dh
movzx r10, ah
movzx r15, ch

etc.

Update release version

Since we have supported IDA 7.00 and some new bugs have been solved, maybe it is time to pack a new release version?

Could not change String values directly

It would be great to be able to change string values directly.

There should be a field to change the String value directly.

Workaround for IDA 6.9 on Linux x64

Keypatch has problems in IDA 6.9 on Linux x64. I think this is because in Linux x64 IDA will use it's built-in Python, which is 32 bit, instead of the system's 64 bit Python. This is messy, but it is how IDA works currently, so we need to work around it (a pure IDA 64 bit version is promised soon).

In order to use Keypatch, you need to do the following steps:
1- Follow instructions in the README:
$ git clone https://github.com/keystone-engine/keystone/
$ mkdir build
$ cd build
$ ../make-share.sh lib32 lib_only
<------ STOP HERE (Readme will tell you to do make install)

2- Copy python bindings to IDA Python
$ cp -r bindings/python/keystone IDA_DIR/python/

3- Copy distutils from your distro's Python to IDA
$ cp -r /usr/lib/python2.7/distutils IDA_DIR/python/

4- Copy the 32 bit Keystone libraries to IDA's Python seach path
$ mkdir -p /python/lib/python2.7/dist-packages/keystone
$ cp build/llvm/lib/libkeystone.so.* IDA_DIR/python/lib/python2.7/dist-packages/keystone

5- Finally copy keypatch.py to IDA_DIR/plugins/

All done, works like a charm now.

IDA7.0 on Win10

I followed all the installation steps, but I received these errors:

C:\Program Files\IDA 7.0\plugins\keypatch.py: No module named six
Traceback (most recent call last):
File "C:\Program Files\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
execfile(script, g)
File "C:/Program Files/IDA 7.0/plugins/keypatch.py", line 56, in
import six
ImportError: No module named six

Issue about how to generate hex of an ARM instruction, which has a negative offset

I use command

kstool arm 'b -0x168'

but i got

ERROR: Invalid operand (KS_ERR_ASM_INVALIDOPERAND)

Can anyone help me to solve this?

Possible bug with arm64 conditional branch

One picture says it all.

Confirmed with http://armconverter.com/

This happens too with KeyStone python binding

KeyStone did not take the address of the B.COND instructions into consideration (i.e. nothing happens if the second param is changed).

64-bit fixup is losing high bits of address

Steps to reproduce:

1. Open a 64-bit application in IDA 7.0, for example, firefox.exe.
2. At the beginning of 'main()' function try to patch 'jmp main'. The dialog would show:

Assembly: jmp main
- Fixup:  jmp 0x40001090
- Encode: ...

if you replace it with jmp 0x140001090, then it works.

Init Warning in Windows10 x64, IDA 7.0

Following the installation instructions, I completed the installation of keypatch.

• But when I launch the IDA, I got the following warning:

Failed while executing plugin_t.init():
Traceback (most recent call last):
  File "C:/Program Files/IDA 7.0/plugins/keypatch.py", line 1499, in init
    menu = idaapi.add_menu_item("Edit/Keypatch/", "Patcher     (Ctrl-Alt-K)", "", 1, self.patcher, None)
AttributeError: 'module' object has no attribute 'add_menu_item'

The Python27 version on my pc is Python 2.7.14 (v2.7.14:84471935ed, Sep 16 2017, 20:25:58) [MSC v.1500 64 bit (AMD64)], and I have installed keystone correctly on my pc.

• I print my system path in IDA console:

Python>print sys.path
['C:\\Windows\\SYSTEM32\\python27.zip', 'C:\\Program Files\\python2\\Lib', 'C:\\Program Files\\python2\\DLLs', 'C:\\Program Files\\python2\\Lib\\lib-tk', 'C:\\Program Files\\IDA 7.0\\python', 'C:\\Program Files\\python2', 'C:\\Program Files\\python2\\lib\\site-packages', 'C:\\Program Files\\IDA 7.0\\python\\lib\\python2.7\\lib-dynload\\ida_64', 'C:\\Program Files\\IDA 7.0\\python', 'C:/Program Files/IDA 7.0/plugins', 'C:/Program Files/IDA 7.0/loaders']

• And Keystone:

Python>print keystone
<module 'keystone.keystone' from 'C:\Program Files\python2\lib\site-packages\keystone\keystone.py'>

Any suggestions?

Error in Ida Pro 7.0

D:\IDA 7.0\plugins\keypatch.py: cannot import name arm_const
Traceback (most recent call last):
File "D:\IDA 7.0\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
execfile(script, g)
File "D:\IDA 7.0\plugins\keypatch.py", line 23, in
from keystone import *
File "C:\Python27\lib\site-packages\keystone_init_.py", line 2, in
from . import arm_const, arm64_const, mips_const, sparc_const, hexagon_const, systemz_const, ppc_const, x86_const
ImportError: cannot import name arm_const

keypatch failure

IDA 7.0
The latest version of keypatch

so link: https://drive.google.com/file/d/1xHsJ1DAwy6FkuhOuvCTaHGH7QP0g974D/view?usp=sharing

in .text:0000F2F0
MOV R0, #0x9F858692

I want to change 0x9F858692 to 0x98858692, that is MOV R0, #0x9F858692 to MOV R0, #0x98858692, but keypatch fails to decompile bytecode

The error is reported as follows:

Excessive IDA analysis

Function patch() takes a lot of time to analyze code in cases where a function has chunks at addresses lower than its start. I'm talking about this:

        # ask IDA to re-analyze the patched area
        if orig_func_end == idc.BADADDR:
            # only analyze patched bytes, otherwise it would take a lot of time to re-analyze the whole binary
            idaapi.analyze_area(address, address + patched_len + 1)
        else:
            idaapi.analyze_area(address, orig_func_end)
            # try to fix IDA function re-analyze issue after patching
            idaapi.func_setend(address, orig_func_end)

In IDA v7.0 is apparently enough to do only idaapi.analyze_area(address, address + patched_len + 1).

Installation issues

Followed the instructions on a Mac with the latest IDA 7, but getting an ImportError.
keypatch.py: cannot import name arm_const

Any suggestions?

IDA 7.5 Issue

Installed newest Keypatch but getting:

keypatch.py: name 'KS_ARCH_X86' is not defined
Traceback (most recent call last):
File "\python\3\ida_idaapi.py", line 615, in IDAPython_ExecScript
exec(code, g)
File "/plugins/keypatch.py", line 265, in
class Keypatch_Asm:
File "/plugins/keypatch.py", line 268, in Keypatch_Asm
"X86 16-bit": (KS_ARCH_X86, KS_MODE_16), # X86 16-bit
NameError: name 'KS_ARCH_X86' is not defined

Tried everything but it won't go away.

Problem with installing keystone-engine on MacOS

Open the Term

and typed "sudo pip install keystone-engine", but it can not be compiled on my Mac.

here are the problems:

So how do I fix it? Thank you.

P.S. I use MacOS 10.14 Mojave beta 5.

Unable to patch Header content

I want to patch the RVA of the entrypoint in a PE file. Here is an example:

It turn out that I cannot modify the content. Alway getting this error:

Here is which options I tried:

The initial autoanalysis has been finished.
Keypatch: attempting to modify "dd rva _mainCRTStartup" at 0x4000A8 to "dd rva 1a00h, rva 1a00h"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 1a00h, 1a00h"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 001ah, 001ah"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 0x001a"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 0x1a00"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 0x401a00"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "0x1a00"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 1222h"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 001ah, 001ah"
Keypatch: attempting to modify "dd 1220h" at 0x4000A8 to "dd 1220h, 1220h"

Error while resolving assambly with variable names

When trying to do something like this:

You get the following error:

Is there a way that keypatcher auto resolve the addresses?

Update release for ida 7.0

Hello
The latest release https://github.com/keystone-engine/keypatch/releases
have code for adding the action menu to ida 7.x ,however since the release is missing the version check
if idaapi.IDA_SDK_VERSION >= 700:
it jumps to the older
idaapi.add_menu_item
Maybe push the latest comments to a new release so this is avoided, since with the version check, all is working flawless.

keep up the awsome work.